AdvisoriesADV-2026-05
High priority typology APP fraud Social engineering DuitNow

Authorised push payment fraud on instant rails

Updated 21 Oct 2026 For Public · Banks · Payment providers By FraudWatch Admin
In short — for everyone

A scammer convinces you to send the money yourself. Because you approved the transfer, it goes through instantly — and is much harder to get back.

They usually pose as your bank, the police, a courier, a government agency or someone you know, and tell you your money is at risk or a payment is overdue.

How it works

  1. 01 · Contact A call, WhatsApp or SMS out of the blue
  2. 02 · Story Your account is linked to a crime, or a parcel is held
  3. 03 · Pressure Act now, stay on the line, tell no one
  4. 04 · Payment You transfer to a "safe account" they control

The receiving account is almost always a mule account — rented or recruited — and funds are split and moved on within minutes. See ADV-2026-03.

Red flags

  • You're asked to move money to protect it. No bank or agency ever asks this.
  • The call is transferred between "officers" from different agencies.
  • You're told to stay on the call while you open your banking app.
  • The name on the receiving account doesn't match who you think you're paying.
For banks & payment providers

Indicators and controls

Indicators
  • First-time payee, high value relative to customer history
  • Active voice call during the banking session
  • Rapid sequence of transfers draining balances or limits
  • Limit increases or new device binding shortly before payment
  • Beneficiary account recently opened or with high inbound velocity
Controls to consider
  • Dynamic friction and cooling-off on risky first-time payments
  • Payee name confirmation shown before authorisation
  • Scenario-specific warnings, not generic pop-ups
  • Inbound mule detection on the receiving side
  • Fast inter-bank fund holding via NSRC

If it happened to you

Call NSRC on 997 and your bank's fraud line now. Then make a police report. Call 997
See the full first-hour checklist
Related advisories
ADV-2026-03 Mule account networks on instant payment rails ADV-2026-06 C-suite impersonation via deepfake audio cloning